Privacy Policy — Carpooling
Version: 0.2 — DRAFT — PLACEHOLDERS TO REPLACE Date: 25 August 2026 Effective date: 31 December 2099
1. Controller
[[DRAFT: DENOMINAZIONE LEGALE]], [[DRAFT: SEDE LEGALE COMPLETA]], [[DRAFT: CODICE FISCALE]] / [[DRAFT: PARTITA IVA]]
Privacy: privacy@placeholder.invalid
DPO, if appointed: [[DRAFT: DPO CONTACT OR NOT APPOINTED]]
2. Scope
This notice covers Service users, people involved in invitation/report functions and people contacting the Operator. The Service is for adults aged 18+.
3. Data we process
Depending on the functions used, we may process:
- account data such as name, phone, optional email, account-verification information, age declaration and legal consents/acknowledgements;
- optional profile data such as photo, date of birth, gender, travel preferences and interests;
- mobility data such as origin, destination, meeting points, days, times, availability and information needed to suggest compatible trips/users;
- vehicle information needed when acting as driver;
- group and trip information;
- messages, photos and related communication data;
- cost estimates, credits, debts and settlement status;
- blocks, reports and moderation information;
- technical data strictly necessary to operate, secure and troubleshoot the Service, such as IP address, app/device information, session data and technical logs.
The Service is not designed for continuous location tracking.
The Operator does not process payment-card or bank-account data to settle amounts between users and does not execute those payments.
4. Purposes and legal bases
We process data to create/manage accounts; provide profiles, groups, trips, communications and compatibility suggestions; display cost/balance information; send operational communications; prevent abuse/fraud; handle reports/claims; comply with law; and, with consent where required, send marketing.
The legal bases are performance of the contract, legitimate interests, legal obligations and consent, depending on the purpose.
5. Required and optional data
Some information is required for registration or a chosen feature. Other information is optional. Not providing required data may prevent access to that function.
6. Compatibility suggestions
The Service may use information such as route, availability, times and preferences to organise and rank possible matches.
This does not, by itself, constitute solely automated decision-making producing legal or similarly significant effects. Users make the final decision to contact, invite, join a group or travel.
7. Sensitive data
The Service does not request special-category data such as health, religion, political views or sexual orientation for compatibility suggestions. Users should avoid adding such information where unnecessary.
Free-form messages, photos or reports may incidentally contain sensitive information; it is processed only as necessary for the relevant function, safety, report handling or legal obligations.
8. Who can see data
Depending on the feature, information may be visible to users you interact with, group members/admins, trip participants, authorised conversation participants and authorised Operator staff where needed for support, security or moderation.
9. Recipients and categories of providers
To provide the Service, personal data may be disclosed or made accessible, where necessary, to providers of:
- IT infrastructure and hosting;
- maps, routing and mobility information;
- phone verification and communications;
- notifications;
- content storage and management;
- information security;
- technical support.
Such providers process personal data according to the privacy role applicable to their activities and under the arrangements required by law.
Data may also be disclosed to public authorities or other recipients where required or permitted by law.
More information about recipients can be requested at privacy@placeholder.invalid.
10. International transfers
Some providers may process data outside the EEA. Where required, we use GDPR-compliant mechanisms such as adequacy decisions, Standard Contractual Clauses or other lawful safeguards.
11. Retention
We keep data only as long as necessary for the relevant purpose and, where needed, for legal obligations, disputes, abuse prevention or defence of rights.
Account data is kept during the account lifecycle and then deleted/anonymised subject to lawful retention needs. Group/trip/message/balance/content data follows the relevant feature lifecycle. Security/report/log data may be kept longer where necessary. Consent and contract evidence may be retained as needed to demonstrate compliance. Backups expire according to normal technical retention cycles.
12. Security
We use appropriate technical and organisational measures to protect personal data. No system can guarantee zero risk.
13. Rights
Where applicable, users may exercise rights of access, rectification, erasure, restriction, portability, objection and consent withdrawal by contacting privacy@placeholder.invalid.
14. Complaint
Users may complain to the Italian Garante or another competent supervisory authority.
15. Marketing
Marketing is optional, separate from the Terms and sent only when legally permitted and, where required, with consent. Withdrawal does not prevent strictly necessary account, safety, group or trip communications.
16. Children
The Service is 18+. Suspected underage accounts can be reported to privacy@placeholder.invalid.
17. Data received from other users
We may receive information about a person from another user through invitations, messages, photos, groups or reports. We process it only as necessary for the relevant function and applicable law.
18. Changes
Significant updates to this notice will be communicated appropriately. Fresh consent will be requested only where legally required.
19. Contacts
Privacy: privacy@placeholder.invalid
DPO, if appointed: [[DRAFT: DPO CONTACT OR NOT APPOINTED]]
Address: [[DRAFT: SEDE LEGALE COMPLETA]]